Slashdot Mirror
FTC vs. Open SMTP Relays
HighOrbit writes "Cnet reports on news.com.com that The U.S. Federal Trade Commission, several state Attorneys General, and Australia, Canada and Japan are sending this letter (pdf) to operators of open relay mail servers to educate them on the dangers of open relays and how they help spread spam. Although the letter does not threaten direct law enforcement action, it does let open relayers know that they have been noticed and warned. The threat of being blacklisted has not worked yet, so will this finally convince mail server admins to shut down those open relays?"
Let open relays suffer the consequences for the spam that they inadvertantly relay. They should be open to lawsuits.
Maybe I'm the only one that had this train of thought, but I'll put it here anyways. I, personally, run a home-based server that runs many services (web, ftp, SMTP and POP3 are some of them).
The threat of being blacklisted would make me change my ways, as I have nothing to gain and everything to lose should that happen. I would presume the same is true for most sys admins out there, who run *honest* servers.
Now let's say that the few "Open Relay" servers that are left are threatened, but they don't take action. Pardon my conspiracy theory, but it may very well be that these "innocent" open relays are in fact sponsored by spam clearinghouses, in which case server admins have monetary incentive to NOT close their relays.
I'd imagine the few open relays that are left are supported by spammers in some way, as they are key in spreading spam, and most people don't want spam passing through their systems anyway, so any anti-spam person would probably close their relays as soon as they are first notified.
So to relate this to the article, I'd say that a letter from the FTC that doesn't threaten *legal* action will provide no more incentive to these system administrators to close the relays; thus the letters become little more than a waste of paper...
Just my thoughts on the matter.
Rumor has it that there's a whole bunch of open relays out there which are owned by the spamhausen. (I'd love to see some evidence to the contrary, but that's asking proof of a negative, so I won't hold my breath.) If we accept that rumor as fact for the sake of argument, all the FTC letter is going to do is tell said spamhausen that their crap is getting to the target audiences, and they'll happily redouble their efforts.
It's been said before, but it's worth repeating. The best way to eliminate spam is not to go after the machines (and coincidentally the people in charge of the care and feeding of them). Go after the people and companies hiring the spamhausen...the ones pushing their "herbal Viagara" (sic), pr0n, better mortgage rates, and so forth down the wire and into our overloaded mail accounts. Take away the revenue stream, and all those open relays will go idle until someone puts them to better use (for example, Quake 3 servers).
Just my two cents' worth...save up the change for a root beer or something.
All the world's an analog stage, and digital circuits play only bit parts.
Signed by (among others) the attorneys general of Texas, Louisiana, Oklahoma, Arkansas, and New Mexico. Where are the states that are sterotypically tech-savvy? Where's Washington? Where's California? Why are southern states taking the lead on this? I'd think it was just a regional US thing if it weren't for the international signatures on there. Is it easier to get international agreement than interstate agreement? Seriously, what gives here?
Imagine my utter surprise when I returned from running to the PO and Baja Fresh, during lunch, hit [Get Msgs] and Nothing was there to download!!!
I've been getting from 120-180 Ralsky-grams a day and nothing in the space of 45 minutes is downright unbelievable. I zipped over to the news to see if his house had been raided or he'd been kill by an irate sysadmin. Nothing on the news about it, maybe something is happening? If so, he and his animal food trough wiper friends will probably take a little while to shift over to some other sites and get caught up.
A feeling of having made the same mistake before: Deja Foobar
The real problem? Wierd foreign programmers who don't understand How Things Work and moreover don't care, and executives that just want a working system and to hell with being a good netizen.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
It's a protocol problem. SMTP is never going to be good enough. For example, I run qmail, courier, horde/imp. To keep it from being an open relay I use relay-ctrl. However in my testing (to make sure it wasn't open) I found a few very interesting things. On 99% of email servers if you know how to properly input the mail headers you can send anyone an email on that server.
... in conjunction with the OSS community) it would (theoretically) solve a growing problem.
;^)
Granted this isn't an open relay but if you have a list of everyone at intel (or not just figure out their email addresses via a web search). You could easily email all of them anything you wanted (as the spammer) only using their own mail server. I havent tried this on a lot of servers but I have a very high success rate (I only try it with my friends accounts on different servers and I let them know ahead of time so they aren't confused).
This just helps make my point. Non authenticated SMTP is killing the internet. If the big whigs would come out with a new OPEN protocol (AOL, MSN, Earthlink,
It would be good for the software makers of email clients/servers as well because they could sell an entirely new set of software.
I guess I'm just idealistic. I think it can be done.
Then again, if one more damn tornado gets within 2 miles of me I may move to Colorado (like all the Californians! lol
Maybe the documentation for their mail server is only in English and they only know some other language(s) so they can't find out about how to properly use the server. Supposedly this is part of the problem with open relays in Asia.
This doesn't make me a hypocrite. It makes me able to appreciate different factors of things and evaluate them all seperately as a basis for rating the whole. To suggest that because I hat one part of one thing means that I MUST hate the rest is ludicrous. To suggest even more that because I disliked something in the past, that I must dislike it forever is even worse. Under that theory, I'd still hate beer (mmm
Things change, people change.
-Ab
Nothing fails quite like prayer.
Hrrrm. It's actually a bit more difficult than that. Spammers actively look for ways around non-relaying servers, especially in this day of web-based mail forms. We had an incident where a spammer discovered that a poorly coded cgi-form would allow different e-mail addresses to be sent using our web-based mail submittal form. Even though the server was secured against relaying, it wasn't secured against receiving thousands of submittals through its web form. We only noticed it when someone complained to our ISP, who forwarded the notice on to us. We patched it up and sent an apology to our ISP and the original complainer.
Moral of the story - don't give up complaing to an ISP about spam. You may actually get them to do something about it.
I hate to say it, but this isn't nearly as much work as you might think. All it takes is a little special coding and some database maintenance -- something serious spammers would be more than willing to do. By maintaining a table of mail servers for each domain, a program could easily be created that scans through the list of email addresses, selects the correct mail server for its domain and then routes the email directly through that server. The most work would be maintaining the table of mail servers, but they could just target the big ones like Earthlink, AOL, MSN, Yahoo, Hotmail, etc. If this ever happens, you may see a rise in the popularity of Ma & Pa ISPs again.
On a good note, spammers who directly route through the recipient's mail server will be much easier to track down -- unless they break into another computer system to do their dirty work.
GreyPoopon
--
Why is it I can write insightful comments but can't come up with a clever signature?
"Come on, you don't mean that. If somebody sneaks into your house while you're not looking, "borrows" your gun, goes out an kills somebody, you're responsible? You could be accused of negligence but you're not really responsible for the killing"
Here in Calif. unless you lock it up, with an approved security device or trigger guard YES you are and can be held responsible for gross negligence and possible homicide...no one has taken the homicide charge yet buty there have been cases of negligence enforced I believe...
I agree with you on the Key issue regarding email though...
errr....umm...*whooosh* *whoosh* Is this thing on ?
Who is going to check every header in every email?
.01% response rat is concidered wildly sucsessfull by SPAMMERS.
obviously nobody is going to even try, but a yahoo, aol, msn, Earthlink, or hotmail are going to have hundreds of smtp machines load balanced off one IP address, set up ten out of a hundred to check headers throughly and it'll stop a lot of spam.
I know that your thinking that this would be like the dutch-boy with his finger in the dike, here why I think it would be effective
1. a spam campain that generate a
2. if you block the one email out of ten thousand that generates revenue, then the spammer has to send an additional 10K Emails to make up the shortfall.
the cost to the ISP rise linearly, the cost to the SPAMMER rise exponetily; and the ISP have deeper pockets to begin with. Add in the blacklists and the big time spammers are done.
Apocalypse Cancelled, Sorry, No Ticket Refunds